virus rootkit.gen

[jelo66]

bonjour

j ai un virus rootkit.gen et je n arrive pas a le supprimer. j ai besoin d aide svp.merci d avance. j ai le rapport de combofix. le voici.

 

ComboFix 10-02-20.04 - jelo66 21/02/2010 13:37:10.2.3 - x86

Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6002.2.1252.33.1036.18.3070.1911 [GMT 1:00]

Lancé depuis: c:\users\jelo66\Desktop\ComboFix.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.

 

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\users\jelo66\AppData\Local\Microsoft\Windows\Temporary Internet Files\6-1PDbu

 

.

((((((((((((((((((((((((((((( Fichiers créés du 2010-01-21 au 2010-02-21 ))))))))))))))))))))))))))))))))))))

.

 

2010-02-21 12:42 . 2010-02-21 12:42 -------- d-----w- c:\users\jelo66\AppData\Local\temp

2010-02-21 12:42 . 2010-02-21 12:42 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp

2010-02-21 12:42 . 2010-02-21 12:42 -------- d-----w- c:\users\Public\AppData\Local\temp

2010-02-21 12:42 . 2010-02-21 12:42 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-02-10 17:10 . 2009-12-08 20:01 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-10 17:09 . 2009-12-08 20:01 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys

2010-02-10 17:09 . 2009-12-08 17:26 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys

2010-01-31 11:38 . 2010-01-31 11:38 509552 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb410.tmp.exe

2010-01-28 14:44 . 2010-02-07 18:57 -------- d-----w- c:\users\jelo66\ClubDeJeux

2010-01-28 14:23 . 2010-01-28 14:23 -------- d-----w- c:\programdata\Zylom

 

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-02-21 12:41 . 2009-04-20 21:22 -------- d-----w- c:\program files\VideoLAN

2010-02-21 12:39 . 2009-02-26 16:34 -------- d-----w- c:\program files\Google

2010-02-21 09:01 . 2008-11-04 00:06 669328 ----a-w- c:\windows\system32\perfh00C.dat

2010-02-21 09:01 . 2008-11-04 00:06 123350 ----a-w- c:\windows\system32\perfc00C.dat

2010-02-20 16:53 . 2009-04-10 15:55 -------- d-----w- c:\programdata\Google Updater

2010-02-17 12:33 . 2009-02-02 18:23 -------- d-----w- c:\users\jelo66\AppData\Roaming\PlayFirst

2010-02-17 12:33 . 2009-02-02 18:23 -------- d-----w- c:\programdata\PlayFirst

2010-02-17 12:33 . 2009-02-26 16:33 -------- d-----w- c:\users\jelo66\AppData\Roaming\Zylom

2010-02-17 09:29 . 2008-11-03 15:44 -------- d-----w- c:\programdata\CyberLink

2010-02-11 02:17 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail

2010-02-06 18:32 . 2009-11-29 13:58 -------- d-----w- c:\program files\SFR

2010-01-23 02:17 . 2009-04-11 18:59 -------- d-----w- c:\program files\Microsoft Silverlight

2010-01-19 12:51 . 2010-01-19 12:51 -------- d-----w- c:\program files\Windows Portable Devices

2010-01-19 12:51 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat

2010-01-19 12:51 . 2010-01-19 12:51 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf

2010-01-18 17:37 . 2010-01-18 17:37 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-01-18 17:37 . 2008-11-03 15:55 -------- d-----w- c:\program files\Java

2010-01-18 08:47 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Calendar

2010-01-18 08:47 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Sidebar

2010-01-18 08:47 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Collaboration

2010-01-18 08:47 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Photo Gallery

2010-01-18 08:46 . 2006-11-02 12:35 -------- d-----w- c:\program files\Windows Defender

2010-01-18 08:46 . 2008-11-03 15:43 -------- d-----w- c:\programdata\NVIDIA

2010-01-14 10:12 . 2009-10-02 16:54 181120 ------w- c:\windows\system32\MpSigStub.exe

2010-01-12 19:07 . 2010-01-06 14:29 -------- d-----w- c:\users\jelo66\AppData\Roaming\Ubisoft

2010-01-12 14:45 . 2010-01-06 14:14 -------- d-----w- c:\users\jelo66\AppData\Roaming\MysteryStudio

2010-01-04 15:40 . 2010-01-04 15:40 -------- d-----w- c:\users\jelo66\AppData\Roaming\DivoGames

2010-01-02 06:38 . 2010-01-22 07:54 916480 ----a-w- c:\windows\system32\wininet.dll

2010-01-02 06:32 . 2010-01-22 07:54 71680 ----a-w- c:\windows\system32\iesetup.dll

2010-01-02 06:32 . 2010-01-22 07:54 109056 ----a-w- c:\windows\system32\iesysprep.dll

2010-01-02 04:57 . 2010-01-22 07:54 133632 ----a-w- c:\windows\system32\ieUnatt.exe

2009-12-25 19:43 . 2009-12-25 19:43 1167360 ----a-w- c:\windows\system32\Puqqgbi7-S8hNFW.dll

2009-12-16 12:58 . 2009-01-31 21:00 78728 ----a-w- c:\users\jelo66\AppData\Local\GDIPFONTCACHEV1.DAT

2009-12-15 13:33 . 2009-12-15 13:33 4096 ----a-w- c:\windows\d3dx.dat

2009-12-11 11:43 . 2010-02-10 17:10 302080 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-11 11:43 . 2010-02-10 17:10 98816 ----a-w- c:\windows\system32\drivers\srvnet.sys

2009-12-11 07:38 . 2009-10-01 08:38 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-12-08 20:01 . 2010-02-10 17:10 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-04 18:30 . 2010-02-10 17:10 12288 ----a-w- c:\windows\system32\tsbyuv.dll

2009-12-04 18:29 . 2010-02-10 17:10 1314816 ----a-w- c:\windows\system32\quartz.dll

2009-12-04 18:28 . 2010-02-10 17:10 22528 ----a-w- c:\windows\system32\msyuv.dll

2009-12-04 18:28 . 2010-02-10 17:10 31744 ----a-w- c:\windows\system32\msvidc32.dll

2009-12-04 18:28 . 2010-02-10 17:10 123904 ----a-w- c:\windows\system32\msvfw32.dll

2009-12-04 18:28 . 2010-02-10 17:10 13312 ----a-w- c:\windows\system32\msrle32.dll

2009-12-04 18:28 . 2010-02-10 17:10 82944 ----a-w- c:\windows\system32\mciavi32.dll

2009-12-04 18:28 . 2010-02-10 17:10 50176 ----a-w- c:\windows\system32\iyuv_32.dll

2009-12-04 18:27 . 2010-02-10 17:10 91136 ----a-w- c:\windows\system32\avifil32.dll

2009-12-04 15:56 . 2010-02-10 17:10 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2009-12-04 15:56 . 2010-02-10 17:10 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2008-11-04 00:20 . 2008-11-04 00:20 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT

.

 

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89b040f0-5ca6-7b68-cb8f-31c7c57c5f19}]

2009-12-25 19:43 1167360 ----a-w- c:\windows\System32\Puqqgbi7-S8hNFW.dll

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-16 39408]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-17 13535776]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-17 92704]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-02 75008]

"DPService"="c:\program files\HP\DVDPlay\DPService.exe" [2008-06-11 90112]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-18 149280]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"AVFX Engine"="c:\program files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-09 24576]

"V0220Mon.exe"="c:\windows\V0220Mon.exe" [2006-05-16 28672]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)

 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"VistaSp2"=hex(b):7d,ca,f2,95,1b,98,ca,01

 

R2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [01/10/2009 09:38 108289]

R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [21/01/2008 03:33 21504]

R3 V0220Dev;Live! Cam Video IM;c:\windows\System32\drivers\V0220Dev.sys [31/01/2009 23:36 145472]

R3 V0220Vfx;V0220VFX;c:\windows\System32\drivers\V0220Vfx.sys [31/01/2009 23:36 6272]

S2 gupdate1c9d871684f15e2;Service Google Update (gupdate1c9d871684f15e2);c:\program files\Google\Update\GoogleUpdate.exe [19/05/2009 12:03 133104]

S3 fssfltr;FssFltr;c:\windows\System32\drivers\fssfltr.sys [24/11/2009 09:37 54632]

S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]

 

--- Autres Services/Pilotes en mémoire ---

 

*Deregistered* - ocnqoa

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

ezSharedSvc

.

Contenu du dossier 'Tâches planifiées'

 

2010-02-21 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-02-26 15:55]

 

2010-02-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-19 11:03]

 

2010-02-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-19 11:03]

 

2010-02-21 c:\windows\Tasks\User_Feed_Synchronization-{D2664CD5-270A-4CCE-9BA5-188ABF8442CF}.job

- c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]

.

.

------- Examen supplémentaire -------

.

uStart Page = hxxp://www.google.com/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fr_fr&c=84&bd=Presario&pf=cndt

IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://game07.zylom.com/activex/zylomgamesplayer.cab

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-02-21 13:42

Windows 6.0.6002 Service Pack 2 NTFS

 

Recherche de processus cachés ...

 

Recherche d'éléments en démarrage automatique cachés ...

 

Recherche de fichiers cachés ...

 

Scan terminé avec succès

Fichiers cachés: 0

 

**************************************************************************

 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ocnqoa]

 

.

Heure de fin: 2010-02-21 13:45:03

ComboFix-quarantined-files.txt 2010-02-21 12:45

ComboFix2.txt 2010-02-21 12:21

 

Avant-CF: 382 246 281 216 octets libres

Après-CF: 382 348 484 608 octets libres

 

Current=1 Default=1 Failed=0 LastKnownGood=10 Sets=1,2,3,4,5,6,7,8,9,10

- - End Of File - - 7EEBC702A5FA92F2C894233355F06476

[Forester]

Salut Jelo66,

 

Je t'invites à mettre ton post dans la section "sécurité" pour que l'équipe de sécurité te vienne en aide.

Et ne post un rapport combofix que s'il te le demande, commence avec un rapport Hijackthis.

 

Un modérateur déplacera surement ton post.

[jelo66]

Salut Jelo66,

 

Je t'invites à mettre ton post dans la section "sécurité" pour que l'équipe de sécurité te vienne en aide.

Et ne post un rapport combofix que s'il te le demande, commence avec un rapport Hijackthis.

 

Un modérateur déplacera surement ton post.

 

*

merci je l ai depalce et desole.